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Category: Computers > Security > Virtual Private Networks > Protocols 
HMAC rfc draft (long) 

... lndex][Thread Index] HMAC rfc draft (long). To: ipsec@TIS.COM; Subject: 
HMAC rfc draft (long); From: "H.Krawczyk" <hugo@watson.ibm.com>; ... 
www.sandelman.ottawa.on.ca/ipsec/1996/10/msg00058.html - 26k - Cached - Similar pages 

Network Working Group H. Krawczyk Request for Comments: 2104 IBM ... 
... Krawczyk, et. al. Informational [Page 1] RFC 2104 HMAC February 1997 HMAC can 
be used in combination with any iterated cryptographic hash function. ... 
www.ietf.org/rfc/rfc2104.txt - 23k - Cached - Similar pages 

Network Working Group M. Oehler Request for Comments: 2085 NSA ... 

... Oehler & Glenn Standards Track [Page 1] RFC 2085 HMAC-MD5 February 1997 To provide 

protection against replay attacks, a Replay Prevention field is included as ... 

www.ietf.org/rfc/rfc2085.txt - 14k - Cached - Similar pages 

[ More results from www.ietf.org ] 

Network Working Group C. Madson Request for Comments: 2404 Cisco ... 
... 1. Introduction This memo specifies the use of SHA-1 [FIPS-180-1] combined with 
HMAC [RFC-2104] as a keyed authentication mechanism within the context of the ... 
csrc.nist.gov/ipsec/papers/rfc2404-hmacsha.txt - 14k - Cached - Similar pages 

RFC 2104 (rfc2104) - HMAC: Keved-Hashinq for Message ... 
... RFC 2104 - HMAC: Keyed-Hashing for Message Authentication. Network 
Working Group H. Krawczyk Request for Comments: 2104 IBM Category ... 

Description; HMAC: Keyed-Hashing for Message Authentication. H. Krawczyk, M. Bellare, R. Canetti. February 
1997. 

Category : Computers > In t ernet > R F Cs > 2 10 1 - 2200 
www.faqs.org/rfcs/rfc2104.html - 24k - Cached - Similar pages 

RFC 2404 (rfc2404) - The Use of HMAC-SHA-1-96 within ESP and AH 
... RFC 2404 - The Use of HMAC-SHA-1-96 within ESP and AH. Network ... Previous: 
RFC 2403 - The Use of HMAC-MD5-96 within ESP and AH. Next ... 

Description: The Use of HMAC-SHA-1-96 within ESP and AH. C. Madson, R. Glenn. November 
1998. 

Category: Computers > Internet > RFCs > 2401 - 2500 
www.faqs.org/rfcs/rfc2404.html - 16k - Cached - Similar pages 
[ More resul ts fro m www.f aq s.o r g ] 

[pdf] Supported VPN Standards 

File Format: PDF/Adobe Acrobat - View as HTML 

... The AH protocol (RFC 2402) allows for the use of various authentication algorithms; 
PIX Firewall has implemented the mandatory MD5-HMAC (RFC 2403) and SHA-HMAC ... 

www.cisco.com/univercd/cc/td/doc/product/ iaabu/pix/pix_62/config/ipsecstd.pdf - Similar pages 

Supported VPN Standards 

... RFC 2402) allows for the use of various authentication algorithms; PIX Firewall 

has implemented the mandatory MD5-HMAC (RFC 2403) and SHA-HMAC (RFC 2404 ... 
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[doc] ISA Server fails when SQL server is unavailable 

File Format: Microsoft Word 2000 - View as HTML 

... unavailable. ISA server stalls its services if the ODBC data source becomes 
unavailable or when it can at authenticate to the SQL server. ... 
www.isatools.org/ODBC_Logging_Fix.doc - Simila r pag es 

Interface Commands (aps-authenticate - cut-through) 

... Router(config-if)# aps authenticate sanjose. Router(config-if)# exit. Router(config ... protect 
interface in the event that the working circuit becomes unavailable): ... 

www.cisco.com/univercd/cc/td/doc/product/software/ ios122/122cgcr/finterj7irfacces.htm - 101 k - Cac he d - 
Similar pages 

Pluggable Non Interactive Authentication Modules.: Administration ... 
... If this keyword is absent, PNIAM_FAIL is returned if some data is unavailable from 
the application. These modules provide authenticate and change functions. ... 
www.msu.ru/pniam/pniam-3.html - 20k - Cached - Similar pages 

<html> <head> </head><bodv><pre><html> <head> &lt ... 

... Implemented - H 10.5.3 502 Bad Gateway - H 10.5.4 503 Service Unavailable t H ... Location 

t H 14.31 Max-Forwards - H 14.32 Pragma - H 14.33 Proxy-Authenticate t H ... 

www.w3.org/Protocols/HTTP/Forum/Reports/Tschalaer2.txt - 6k - Cached - Similar pages 

HTTP Header response lines and Return Codes 

... After, The Retry-After header field can be used with "502 Unavailable" to indicate 
how long the service is expected to be unavailable. WWW-Authenticate, Must be ... 

www.lysator.liu.se/-jmo/http_appendix.html - 7k - Cached - Similar pages 

New York City MichNet Number Unavailable 

New York City MichNet Number Unavailable Until Further Notice. ... able to connect to 
the remote modem on the NAS, but the user cannot authenticate successfully or ... 
www.itcom.itd.umich.edu/dialin/announcements/NYC.html - 2k - Cached - Similar pages 

Sendmail: 451 relay unavailable 

... E-mail through their UW server - error message returned says "451 relay unavailable". ... It's 
possible for a user to authenticate with a mail server and send a ... 
ist.uwaterloo.ca/security/howto/1998-10-20.html - 11k- Cached - Similar pages 

pop3.c - PQP3 protocol methods * * Copyright 1998 bv Eric S. ... 

... else if ((strstr(bufp/*Service M ) || strstr(bufp t "service")) && (strstr(bufp ( M unavailable M ))) 

ok = PS_SERVBUSY ... / if (ctl->server.authenticate == A_ANY) { ok ... 

www.opensource.apple.com/darwinsource/ 10.2.3/fetchmail-7/fetchmail/pop3.c - 24k - Ca ched - Sim il ar pages 
HTTP Response Headers 

... Proxy-Authenticate - The Proxy-Authenticate response-header field MUST be included 
as ... header field can be used with a 503 (Service Unavailable) response to ... 

www.comptechdoc.org/independent/web/ http/reference/httpresponse.html - 7k - Cached - Similar pages 
<html> <head> </head><bodv><pre>&lt:html> <head&gt: &lt ... 
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FFDFi Threat Models introduced by Mobile IPv6 and Requirements for ... 
File Format: PDF/Adobe Acrobat - View as HTML 

... Not specific to MIPv6 CN CN HA HA MN MN Attacker Attacker ICMP Unreachable ICMP 
Unreachable Page 12. ... Requirements D2 - MN SHOULD be able to authenticate BR. ... 

www.ipv6.or.kr/wg/security/lnterim/01-005.pdf - Similar pages 

<html> <head> </head><body><pre><html&qt: &lt:head&gt: &lt ... 

... h&gt; #include &lt;linux/icmp.h&gt ... u_short,int); unsigned nameResolve(char 

*); int authenticate(int,char *); unsigned unreachable, target; int c ... 

www. niksula. cs.hut.fi/-dforsber/synflood/neptune. c - 13k - Cached - Similar pages 

Message Formats and Contents 

... The purpose of this message is the authenticate the mobile node ... UDP fields. ... Van Jacobson 
compression unavailable; 80 home network unreachable (ICMP error received ... 
www.soberit.hut.fi/tik-76.115/98-99/palautukset/ groups/Dynamics/lu/docs/msgJrmts.htm! - 24k - Cached - 
Similar pag es 

Configuring IP Services 

... router returns an ICMP Destination Unreachable message to ... invalid option, it sends 
an ICMP Parameter Problem ... the DRP Server Agent to authenticate DRP queries ... 
www.cisco.com/univercd/cc/td/doc/product/software/ ios121/121cgcr/ip_c/ipcprt1/1cdip.htm - 101k - Cached - 
S i mi l a r pag es 

Configuring IP Services 

... router returns an ICMP destination unreachable message to ... invalid option, it sends 

an ICMP parameter problem ... the DRP Server Agent to authenticate DRP queries ... 

www.cisco.com/univercd/cc/td/doc/product/software/ ios122/122cgcr/fipr_c/ipcprt1/1cfip.htm -101k- 

Cached - Simil ar p ages 

[ More results from www.cisco.com ] 

ICMP in IPSec 

... All other ICMP messages intended for E1' MUST be dropped. ... traffic is attempting to 
reach an unreachable peer gateway ... and will not be able to authenticate, but a ... 

www.sandelman.ottawa.on.ca/ipsec/1999/05/msg00062.html - 18k - Cached - Similar pages 

[pdf] Wireless Networks 

File Format: PDF/Adobe Acrobat - View as HTML 

... unreachable (ICMP error received) 88 home agent unreachable (other ICMP error received ... insert 
by encapsulator for the receiver to authenticate the source ... 
www.cacs.louisiana.edu/-wu/598/note598-3-1 .pdf - Similar pages 

[ p PT] www.iihe.ac.be/homepages/olivier/telorga/Lesson-8.ppt 
File Format: Microsoft Powerpoint 97 - View as HTML 

... ICMP type = dest unreachable. ICMP code = host unreachable, rtr. ... authentication protocol 

(peer must authenticate) checksum. ICMP Router Solicitation, reserved. ... 

Similar pages 
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RFC 2075 (rfc2075) - IP Echo Host Service 

... (The ICMP Destination Unreachable with code 4 is required for MTU discovery under 
RFC-1 191 ... problem (such as requiring sources to authenticate themselves before ... 
Description; IP Echo Host Service. C. Partridge. January 1997. 
Category : C o mpute r s > Internet > RFCs > 2 001 - 21 00 
www.faqs.org/rfcs/rfc2075.html - 15k - Cached - S i milar pa g es 

RFC 2075 - IP Echo Host Service. C. Partridge. 

... (The ICMP Destination Unreachable with code 4 ... RFC 2075 IP Echo Host Service January 
1997 Security ... such as requiring sources to authenticate themselves before ... 
rfc.sunsite.dk/rfc/rfc2075.html - 14k - Cached - Similar pages 

Network Working Group C. Partridge Request for Comments: 2075 BBN ... 
... (The ICMP Destination Unreachable with code 4 ... Partridge Experimental [Page 3] RFC 
2075 IP Echo Host ... such as requiring sources to authenticate themselves before ... 
www.isi.edu/in-notes/rfc2075.txt - 13k - Ca ched - Simil ar p ages 

RFC2075 

... (The ICMP Destination Unreachable with code 4 is required for MTU discovery under 
RFC 1 191 ... problem (such as requiring sources to authenticate themselves before ... 
www.scit.wlv.ac.uk/rfc/rfc20xx/RFC2075.html - 13k - Cached - Similar pages 

Configuring IP Services 

... The second router returns an ICMP Destination Unreachable message to ... Time Stamp, which 
are defined in RFC 791. ... the DRP Server Agent to authenticate DRP queries ... 

www.cisco.com/univercd/cc/td/doc/product/software/ ios121/121cgcr/ip_c/ipcprt1/1cdip.htm - 101k - Cached - 
Similar pa ges 

Configuring IP Services 

... The second router returns an ICMP destination unreachable message to ... Time Stamp, which 
are defined in RFC 791. ... the DRP Server Agent to authenticate DRP queries ... 
www.cisco.com/univercd/cc/td/doc/product/software/ ios122/122cgcr/fipr_c/ipcprt1/1cfip.htm - 101k - 
Cached - Similar pages 
[ More r es u l ts from www.cisco.com ] 

Zvon - RFC 2979 - Firewall Requirements 

... applications can use to authenticate or authorize ... MUST NOT block incoming ICMP Destination 
Unreachable / Fragmentation Needed ... ZVON > RFC Repository > RFC 2979. ... 
www.zvon.org/tmRFC/RFC2979/Output/chapter3.html - 9k - Cached - Similar pages 

Zvon - RFC 2138 - Operation 

... obtained such information, it may choose to authenticate using RADIUS ... the event that 
the primary server is down or unreachable. ... ZVON > RFC Repository > RFC 2138. ... 
www.zvon.org/tmRFC/RFC2138/Output/chapter2.html - 15k - Cached - Similar p ages 
[ Mo re resu lts from www.zvon.o rg ] 

RFC 2522 - web hosting bv Directi 

... session-key(s) make validity key authenticate make privacy ... has received the ICMP message 



http://www.googlexom/search?as_q=authenticate+uraeachable+rfc&n 12/23/03 



Google Search: rfc icmp unreap^ble 



\1|1F7 



Page 1 of 2 




Advanced Search Preferences Language Tools Search Tips 



rfc icmp unreachable 



Google Search 



Web - Images • Groups - Directory- News 
Searched the web for rfc icmp unreachable. 



Results 1 - 10 of about 30,700. Search took 0,27 seconds. 



RFC 792 (rfc792) - Internet Control Message Protocol 

... RFC 792 Source Address The address of the gateway or host that composes the ICMP 

message. ... [Page 3] September 1981 RFC 792 Destination Unreachable Message 0 ... 

Description: Internet Control Message Protocol. J. Postel. September 1981. 

Category: Computers > Internet > RFCs > 0701 - 0800 

www.faqs.org/rfcs/rfc792.html - 32k - Cached - Si milar pag es 



Neohapsis Archives - SecurityFocus Pen-test - RE: ICftflP unreachable — 
... This means that if an OS followed the RFC closely, you can potentially ... 6330 2001 
12:05 To: pen-test securityfocus.com Subject: ICR/IP unreachable question. ... 
archives.neohapsis.com/archives/ sf/pen test/2001 -10/01 81. html - 9k - Cached - Similar pa ges 

Neohapsis Archives - Snort discussion - Re: [Snort-users] SMB RFC? ... 
... message: ronell null.net: "RE: [Snort-users] Can we interpret the ICMP unreachable 
messages?"; In reply to: Fyodor: "Re: [Snort-users] SMB RFC?"; Next in thread ... 
archives.neohapsis.com/archives/ snort/2000-1 1/021 1 .html - 8k - Cached - Similar page s 
[ More results from archives.neohapsis.com ] 



# icmp - Network services, ICRflP # # Created by Kurt Seifried, kurt ... 

... is of the form: # icmp code, icmp code name, type code, type name, type description 

# # 0 echo 0 echo-reply RFC 792 - for echo reply message 3 unreachable 0 net ... 

www.seifried.org/security/ports/icmp.txt - 6k - Cached - Similar pa g e s 

Penetration Testing: RE: ICMP unreachable question 
... This means that if an OS followed the RFC closely, you can ... 3 26 &3*6££0 2001 
12:05 To: pen-test_at_securityfocus.com Subject: ICMP unreachable question. ... 
seclists.org/lists/pen-test/2001/Oct/0190.html - 15k - Cached - S im i la r pa g e s 



Index of tech-net for September, 1997 

... 09/05/1997. Alan Barrett, Re: traceroute termination on ICMP unreachable. Dave 

Huang, Re: ppp problem/question. ... 09/16/1997. Matthias Scheler, NetBSD vs. RFC 1241. ... 

mail-index.netbsd.org/tech-net/1997/09/ - 6k - Cached - Similar pages 

tech-net: Re: traceroute termination on ICMP unreachable 

... claimed that (some/most) > routers rate-limit ICMP unreachable messages, so ... [Is 

there any RFC/Internet Draft proposing rate limiting on ICMP?] There is ... 

mail-index.netbsd.org/tech-net/1997/09/04/0002.html - 3k - Cached - Simi la r pages 
f More results from mail-index.netbsd.org ] 



pen-test 2001/10: RE: ICMP unreachable question 
... This means that if an OS followed the RFC closely, you can potentially ... 6^0 2001 
12:05 To: pen-test@securityfocus.com Subject: ICMP unreachable question I ... 
Iists.jammed.com/pen-test/2001/10/0178.html - 9k - Cached - Similar pages 
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Status of this Memo 

This document specifies an Internet standards track protocol for the 
Internet community, and requests discussion and suggestions for 
improvements. Please refer to the current edition of the "Internet 
Official Protocol Standards" (STD 1) for the standardization state 
and status of this protocol. Distribution of this memo is unlimited. 



This document describes a mechanism for providing cryptographic 
authentication for IPv4 and IPv6 datagrams. An Authentication Header 
(AH) is normally inserted after an IP header and before the other 
information being authenticated. 

1 . INTRODUCTION 

The Authentication Header is a mechanism for providing strong 
integrity and authentication for IP datagrams. It might also provide 
non- repudiation, depending on which cryptographic algorithm is used 
and how keying is performed. For example, use of an asymmetric 
digital signature algorithm, such as RSA, could provide non- 
repudiation . 

Confidentiality, and protection from traffic analysis are not 
provided by the Authentication Header. Users desiring 
confidentiality should consider using the IP Encapsulating Security 
Protocol (ESP) either in lieu of or in conjunction with the 
Authentication Header [Atk95b] . This document assumes the reader has 
previously read the related IP Security Architecture document which 
defines the overall security architecture for IP and provides 
important background information for this specification [Atk95a] . 

1 . 1 Overview 

The IP Authentication Header seeks to provide security by adding 
authentication information to an IP datagram. This authentication 
information is calculated using all of the fields in the IP datagram 
(including not only the IP Header but also other headers and the user 
data) which do not change in transit. Fields or options which need 
to change in transit (e.g., "hop count", "time to live", "ident", 
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"fragment offset", or "routing pointer") are considered to be zero 
for the calculation of the authentication data. This provides 
significantly more security than is currently present in IPv4 and 
might be sufficient for the needs of many users. 

Use of this specification will increase the IP protocol processing 
costs in participating end systems and will also increase the 
communications latency. The increased latency is primarily due to 
the calculation of the authentication data by the sender and the 
calculation and comparison of the authentication data by the receiver 
for each IP datagram containing an Authentication Header. The impact 
will vary with authentication algorithm used and other factors. 

In order for the Authentication Header to work properly without 
changing the entire Internet infrastructure, the authentication data 
is carried in its own payload. Systems that aren't participating in 
the authentication MAY ignore the Authentication Data. When used 
with IPv6, the Authentication Header is normally placed after the 
Fragmentation and End-to-End headers and before the ESP and 
transport -layer headers. The information in the other IP headers is 
used to route the datagram from origin to destination. When used 
with IPv4 , the Authentication Header immediately follows an IPv4 
header . 

If a symmetric authentication algorithm is used and intermediate 
authentication is desired, then the nodes performing such 
intermediate authentication would need to be provided with the 
appropriate keys. Possession of those keys would permit any one of 
those systems to forge traffic claiming to be from the legitimate 
sender to the legitimate receiver or to modify the contents of 
otherwise legitimate traffic. In some environments such intermediate 
authentication might be desirable [BCCH94] . If an asymmetric 
authentication algorithm is used and the routers are aware of the 
appropriate public keys and authentication algorithm, then the 
routers possessing the authentication public key could authenticate 
the traffic being handled without being able to forge or modify 
otherwise legitimate traffic. Also, Path MTU Discovery MUST be used 
when intermediate authentication of the Authentication Header is 
desired and IPv4 is in use because with this method it is not 
possible to authenticate a fragment of a packet [MD90] [Kno93] . 
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1.2 Requirements Terminology 

In this document, the words that are used to define the significance 
of each particular requirement are usually capitalised. These words 
are : 

- MUST 

This word or the adjective "REQUIRED" means that the item is an 
absolute requirement of the specification. 

- SHOULD 

This word or the adjective "RECOMMENDED" means that there might 
exist valid reasons in particular circumstances to ignore this 
item, but the full implications should be understood and the case 
carefully weighed before taking a different course. 

- MAY 

This word or the adjective "OPTIONAL" means that this item is 
truly optional. One vendor might choose to include the item 
because a particular marketplace requires it or because it 
enhances the product, for example; another vendor may omit the 
same item. 

2 . KEY MANAGEMENT 

Key management is an important part of the IP security architecture. 
However, it is not integrated with this specification because of a 
long history in the public literature of subtle flaws in key 
management algorithms and protocols. The IP Authentication Header 
tries to decouple the key management mechanisms from the security 
protocol mechanisms. The only coupling between the key management 
protocol and the security protocol is with the Security Parameters 
Index (SPI), which is described in more detail below. This 
decoupling permits several different key management mechanisms to be 
used. More importantly, it permits the key management protocol to be 
changed or corrected without unduly impacting the security protocol 
implementations . 

The key management mechanism is used to negotiate a number of 
parameters for each "Security Association", including not only the 
keys but also other information (e.g., the authentication algorithm 
and mode) used by the communicating parties. The key management 
mechanism creates and maintains a logical table containing the 
several parameters for each current security association. An 
implementation of the IP Authentication Header will need to read that 
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logical table of security parameters to determine how to process each 
datagram containing an Authentication Header (e.g., to determine 
which algorithm/mode and key to use in authentication) . 

Security Associations are unidirectional. A bidirectional 
communications session will normally have one Security Association in 
each direction. For example, when a TCP session exists between two 
systems A and B, there will normally be one Security Association from 
A to B and a separate second Security Assocation from B to A. The 
receiver assigns the SPI value to the the Security Association with 
that sender. The other parameters of the Security Association are 
determined in a manner specified by the key management mechanism. 
Section 4 of this document describes in detail the process of 
selecting a Security Association for an outgoing packet and 
identifying the Security Assocation for an incoming packet. 

The IP Security Architecture document describes key management in 
detail. It includes specification of the key management requirements 
for this protocol, and is incorporated here by reference [Atk95a] . 

3. AUTHENTICATION HEADER SYNTAX 

The Authentication Header (AH) may appear after any other headers 
which are examined at each hop, and before any other headers which 
are not examined at an intermediate hop. The IPv4 or IPv6 header 
immediately preceding the Authentication Header will contain the 
value 51 in its Next Header (or Protocol) field [STD-2] . 

Example high-level diagrams of IP datagrams with the Authentication 
Header follow . 

+ + + + + + 

| IPv6 Header | Hop-by-Hop/Routing | Auth Header | Others] Upper Protocol | 
+ + + + + + 

Figure 1: IPv6 Example 
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When used with IPv6, the Authentication Header normally appears after 
the IPv6 Hop-by-Hop Header and before the IPv6 Destination Options. 



When used with IPv4, the Authentication Header normally follows the 
main IPv4 header. 

3.1 Authentication Header Syntax 

The authentication data is the output of the authentication algorithm 
calculated over the the entire IP datagram as described in more 
detail later in this document. The authentication calculation must 
treat the Authentication Data field itself and all fields that are 
normally modified in transit (e.g., TTL or Hop Limit) as if those 
fields contained all zeros. All other Authentication Header fields 
are included in the authentication calculation normally. 

The IP Authentication Header has the following syntax: 

+ + + + + 

| Next Header | Length | RESERVED | 
+ + + + + 



+ + + + 

| IPv4 Header | Auth Header | Upper Protocol (e.g. TCP, UDP) | 
+ + + + 



Figure 2 : 



IPv4 Example 



Security Parameters Index 



+ 



+ 



+ 



+ 



Authentication Data (variable number of 32 -bit words) 



+ 



+ 



12345678123456781234567812345678 



Figure 3 : 



Authentication Header syntax 
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3.2 Fields of the Authentication Header 
NEXT HEADER 

8 bits wide. Identifies the next payload after the Authentication 
Payload. This values in this field are the set of IP Protocol 
Numbers as defined in the most recent RFC from the Internet 
Assigned Numbers Authority ( I ANA) describing "Assigned Numbers" 
[STD-2] . 

PAYLOAD LENGTH 

8 bits wide. The length of the Authentication Data field in 32- 
bit words. Minimum value is 0 words, which is only used in the 
degenerate case of a "null" authentication algorithm. 

RESERVED 

16 bits wide. Reserved for future use. MUST be set to all zeros 
when sent. The value is included in the Authentication Data 
calculation, but is otherwise ignored by the recipient. 

SECURITY PARAMETERS INDEX (SPI) 

A 32-bit pseudo-random value identifying the security association 
for this datagram. The Security Parameters Index value 0 is 
reserved to indicate that "no security association exists". 

The set of Security Parameters Index values in the range 1 through 
255 are reserved to the Internet Assigned Numbers Authority (IANA) 
for future use. A reserved SPI value will not normally be 
assigned by IANA unless the use of that particular assigned SPI 
value is openly specified in an RFC. 

AUTHENTICATION DATA 

This length of this field is variable, but is always an integral 
number of 32 -bit words. 

Many implementations require padding to other alignments, such as 
64 -bits, in order to improve performance. All implementations 
MUST support such padding, which is specified by the Destination 
on a per SPI basis. The value of the padding field is arbitrarily 
selected by the sender and is included in the Authentication Data 
calculation . 

An implementation will normally use the combination of Destination 
Address and SPI to locate the Security Association which specifies 
the field's size and use. The field retains the same format for 
all datagrams of any given SPI and Destination Address pair. 
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The Authentication Data fills the field beginning immediately 
after the SPI field. If the field is longer than necessary to 
store the actual authentication data, then the unused bit 
positions are filled with unspecified, implementation- dependent 
values . 

Refer to each Authentication Transform specification for more 
information regarding the contents of this field. 

3.3 Sensitivity Labeling 

As is discussed in greater detail in the IP Security Architecture 
document, IPv6 will normally use implicit Security Labels rather than 
the explicit labels that are currently used with IPv4 [Ken91] 
[Atk95a] . In some situations, users MAY choose to carry explicit 
labels (for example, IPSO labels as defined by RFC- 1108 might be used 
with IPv4) in addition to using the implicit labels provided by the 
Authentication Header. Explicit label options could be defined for 
use with IPv6 (e.g., using the IPv6 end-to-end options header or the 
IPv6 hop-by-hop options header) . Implementations MAY support 
explicit labels in addition to implicit labels, but implementations 
are not required to support explicit labels. If explicit labels are 
in use, then the explicit label MUST be included in the 
authentication calculation. 

4. CALCULATION OF THE AUTHENTICATION DATA 

The authentication data carried by the IP Authentication Header is 
usually calculated using a message digest algorithm (for example, 
MD5) either encrypting that message digest or keying the message 
digest directly [Riv92] . Only algorithms that are believed to be 
cryptographically strong one-way functions should be used with the IP 
Authentication Header. 

Because conventional checksums (e.g., CRC-16) are not 
cryptographically strong, they MUST NOT be used with the 
Authentication Header. 

When processing an outgoing IP packet for Authentication, the first 
step is for the sending system to locate the appropriate Security 
Association. All Security Associations are unidirectional. The 
selection of the appropriate Security Association for an outgoing IP 
packet is based at least upon the sending userid and the Destination 
Address. When host-oriented keying is in use, all sending userids 
will share the same Security Association to a given destination. 
When user-oriented keying is in use, then different users or possibly 
even different applications of the same user might use different 
Security Associations. The Security Association selected will 
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indicate which algorithm, algorithm mode, key, and other security 
properties apply to the outgoing packet. 

Fields which NECESSARILY are modified during transit from the sender 
to the receiver (e.g., TTL and HEADER CHECKSUM for IPv4 or Hop Limit 
for IPv6) and whose value at the receiver are not known with 
certainty by the sender are included in the authentication data 
calculation but are processed specially. For these fields which are 
modified during transit, the value carried in the IP packet is 
replaced by the value zero for the purpose of the authentication 
calculation. By replacing the field's value with zero rather than 
omitting these fields, alignment is preserved for the authentication 
calculation. 

The sender MUST compute the authentication over the packet as that 
packet will appear at the receiver. This requirement is placed in 
order to allow for future IP optional headers which the receiver 
might not know about but the sender necessarily knows about if it is 
including such options in the packet. This also permits the 
authentication of data that will vary in transit but whose value at 
the final receiver is known with certainty by the sender in advance. 

The sender places the calculated message digest algorithm output into 
the Authentication Data field within the Authentication Header. For 
purposes of Authentication Data computation, the Authentication Data 
field is considered to be filled with zeros. 

The IPv4 "TIME TO LIVE" and "HEADER CHECKSUM" fields are the only 
fields in the IPv4 base header that are handled specially for the 
Authentication Data calculation. Reassembly of fragmented packets 
occurs PRIOR to processing by the local IP Authentication Header 
implementation. The "more" bit is of course cleared upon reassembly. 
Hence, no other fields in the IPv4 header will vary in transit from 
the perspective of the IP Authentication Header implementation. The 
"TIME TO LIVE " and "HEADER CHECKSUM" fields of the IPv4 base header 
MUST be set to all zeros for the Authentication Data calculation. 
All other IPv4 base header fields are processed normally with their 
actual contents. Because IPv4 packets are subject to intermediate 
fragmentation in routers, it is important that the reassembly of IPv4 
packets be performed prior to the Authentication Header processing. 
IPv4 Implementations SHOULD use Path MTU Discovery when the IP 
Authentication Header is being used [MD90] . For IPv4, not all 
options are openly specified in a RFC, so it is not possible to 
enumerate in this document all of the options that might normally be 
modified during transit. The IP Security Option (IPSO) MUST be 
included in the Authentication Data calculation whenever that option 
is present in an IP datagram [Ken91] . If a receiving system does not 
recognise an IPv4 option that is present in the packet, that option 
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is included in the Authentication Data calculation. This means that 
any IPv4 packet containing an IPv4 option that changes during transit 
in a manner not predictable by the sender and which IPv4 option is 
unrecognised by the receiver will fail the authentication check and 
consequently be dropped by the receiver. 

The IPv6 "HOP LIMIT" field is the only field in the IPv6 base header 
that is handled specially for Authentication Data calculation. The 
value of the HOP LIMIT field is zero for the purpose of 
Authentication Data calculation. All other fields in the base IPv6 
header MUST be included in the Authentication Data calculation using 
the normal procedures for calculating the Authentication Data. All 
IPv6 "OPTION TYPE" values contain a bit which MUST be used to 
determine whether that option data will be included in the 
Authentication Data calculation. This bit is the third-highest-order 
bit of the IPv6 OPTION TYPE field. If this bit is set to zero, then 
the corresponding option is included in the Authentication Data 
calculation. If this bit is set to one, then the corresponding 
option is replaced by all zero bits of the same length as the option 
for the purpose of the Authentication Data calculation. The IPv6 
Routing Header "Type 0" will rearrange the address fields within the 
packet during transit from source to destination. However, this is 
not a problem because the contents of the packet as it will appear at 
the receiver are known to the sender and to all intermediate hops. 
Hence, the IPv6 Routing Header "Type 0" is included in the 
Authentication Data calculation using the normal procedure. 

Upon receipt of a packet containing an IP Authentication Header, the 
receiver first uses the Destination Address and SPI value to locate 
the correct Security Association. The receiver then independently 
verifies that the Authentication Data field and the received data 
packet are consistent. Again, the Authentication Data field is 
assumed to be zero for the sole purpose of making the authentication 
computation. Exactly how this is accomplished is algorithm 
dependent. If the processing of the authentication algorithm 
indicates the datagram is valid, then it is accepted. If the 
algorithm determines that the data and the Authentication Header do 
not match, then the receiver SHOULD discard the received IP datagram 
as invalid and MUST record the authentication failure in the system 
log or audit log. If such a failure occurs, the recorded log data 
MUST include the SPI value, date/time received, clear-text Sending 
Address, clear-text Destination Address, and (if it exists) the 
clear-text Flow ID. The log data MAY also include other information 
about the failed packet. 
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5. CONFORMANCE REQUIREMENTS 

Implementations that claim conformance or compliance with this 
specification MUST fully implement the header described here, MUST 
support manual key distribution for use with this option, MUST comply 
with all requirements of the "Security Architecture for the Internet 
Protocol" [Atk95a] , and MUST support the use of keyed MD5 as 
described in the companion document entitled "IP Authentication using 
Keyed MD5" [MS95] . Implementations MAY also implement other 
authentication algorithms. Implementors should consult the most 
recent version of the " IAB Official Standards" RFC for further 
guidance on the status of this document. 

6. SECURITY CONSIDERATIONS 

This entire RFC discusses an authentication mechanism for IP. This 
mechanism is not a panacea to the several security issues in any 
internetwork, however it does provide a component useful in building 
a secure internetwork. 

Users need to understand that the quality of the security provided by 
this specification depends completely on the strength of whichever 
cryptographic algorithm has been implemented, the strength of the key 
being used, the correctness of that algorithm' s implementation, upon 
the security of the key management mechanism and its implementation, 
and upon the correctness of the IP Authentication Header and IP 
implementations in all of the participating systems. If any of these 
assumptions do not hold, then little or no real security will be 
provided to the user. Implementors are encouraged to use high 
assurance methods to develop all of the security relevant parts of 
their products. 

Users interested in confidentiality should consider using the IP 
Encapsulating Security Payload (ESP) instead of or in conjunction 
with this specification [Atk95b] . Users seeking protection from 
traffic analysis might consider the use of appropriate link 
encryption. Description and specification of link encryption is 
outside the scope of this note [VK83] . Users interested in combining 
the IP Authentication Header with the IP Encapsulating Security 
Payload should consult the IP Encapsulating Security Payload 
specification for details. 

One particular issue is that in some cases a packet which causes an 
error to be reported back via ICMP might be so large as not to 
entirely fit within the ICMP message returned. In such cases, it 
might not be possible for the receiver of the ICMP message to 
independently authenticate the portion of the returned message. This 
could mean that the host receiving such an ICMP message would either 
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trust an unauthenticated ICMP message, which might in turn create 
some security problem, or not trust and hence not react appropriately 
to some legitimate ICMP message that should have been reacted to. It 
is not clear that this issue can be fully resolved in the presence of 
packets that are the same size as or larger than the minimum IP MTU. 
Similar complications arise if an encrypted packet causes an ICMP 
error message to be sent and that packet is truncated. 

Active attacks are now widely known to exist in the Internet [CER95] . 
The presence of active attacks means that unauthenticated source 
routing, either unidirectional (receive-only) or with replies 
following the original received source route represents a significant 
security risk unless all received source routed packets are 
authenticated using the IP Authentication Header or some other 
cryptologic mechanism. It is noteworthy that the attacks described 
in [CER95] include a subset of those described in [Bel89] . 

The use of IP tunneling with AH creates multiple pairs of endpoints 
that might perform AH processing. Implementers and administrators 
should carefully consider the impacts of tunneling on authenticity of 
the received tunneled packets. 
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